Implement Patch
Use after independent validation confirms one claim.
Install
/plugin install trailofbits/skills/plugins/patching-bugs Run in Claude Code to add the Patching Bugs plugin, then enable this skill.
When to Use
Use after independent validation confirms one claim. Read the record contract. Before target commands, follow its project guidance.
When NOT to Use
Do not use for speculative bug hunting, proof of a completed patch, or a change that cannot be exercised by the local compiler or runtime.
Procedure
Before editing, run
uv run --no-project <script> check --before-repair <run-dir>with the record validator. If this check fails, stop and return its errors for an INCONCLUSIVE report. The gate requiresfinding.repair_scopewith a usable case plan and a consistent attempt count. Use the declared scope as the repair brief. Identify the broken invariant and search within its boundary for every instance of the same violation. Read the threat model only to preserve intended behavior; it is not a gate.Run the project's existing suite and record its results. Write a regression test that fails on the baseline for the named bug and any fixed variant. Observe the failure. Fix the invariant within the repair brief with the smallest reviewable change.
Run the regression test and full existing suite again. Compare before and after failures. Fix new failures or explain a pre-existing one from receipts.
Record every variant as
fixedornot_fixedwith a reason. Produce exactly one local commit. Never push or open a PR. From the baseline, writefix.patchfor production changes andtests.patchfor test changes inpatch/attempt-N/.Write
patch.jsonwith the two commit SHAs, changed-file and line counts, variants, suite results, and your agent identity. If the attempt produced no commit, recordpatch_commit: nulland return it as failed. Manifest the entire attempt directory, including both patch files and the record, usinguv run --no-project <script> manifest <patch-attempt-dir>. Check it with the record validator.
{
"schema_version": 1,
"attempt": 1,
"baseline_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"patch_commit": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"files_changed": 2,
"lines_added": 3,
"lines_removed": 1,
"variants": [],
"suite_before": {"command": "pytest", "passed": 9, "failed": 1, "skipped": 0},
"suite_after": {"command": "pytest", "passed": 10, "failed": 0, "skipped": 0},
"agent": "patcher-1"
}
Rationalizations to Reject
| Shortcut | Required action |
|---|---|
| Only the reported line matters. | Search for the same invariant violation. |
| Minimal means the fewest lines. | Make the smallest reviewable invariant-level fix. |
| Tests pass after the patch. | Show the regression test failed before it. |
More in Patching Bugs
- Patching Bugs See the record contract before creating the run directory.
- Prove Patch Use the original baseline, final patch commit, declared repairscope, and unchanged reproduction package.
- Reproduce Bug Read the record contract.
- Validate Bug Use after reproduce-bug has supplied a finding and PoC package.